VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@3.3.1

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.apache.tomcat/tomcat@3.3.1

Essentials
History (3)

purl	pkg:maven/org.apache.tomcat/tomcat@3.3.1
Tags	Ghost

Next non-vulnerable version	9.0.117
Latest non-vulnerable version	11.0.21
Risk	10.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-6yk2-f8d5-cyc3 Aliases: CVE-2003-0043 GHSA-cvx5-7vc7-rg77	Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.	3.3.1a Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-shq7-jxup-5fgk Aliases: CVE-2003-0042 GHSA-qfw2-wvrw-mvw4	Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.	3.3.1a Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:21.050212+00:00	Apache Tomcat Importer	Fixing	VCID-9rpn-zb26-yfdk	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:21.001658+00:00	Apache Tomcat Importer	Affected by	VCID-shq7-jxup-5fgk	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:20.952330+00:00	Apache Tomcat Importer	Affected by	VCID-6yk2-f8d5-cyc3	https://tomcat.apache.org/security-3.html	38.0.0